Mesh and WDS
What are WDS frames?
Wireless Distribution System (WDS) frames is a special type of data frame defined in the 802.11 standard that has 4 address fields (instead of 3). (You can think of a "data frame" as a wireless network packet.) The standard defines the frame format but does not indicate how it should be used.
Early 802.11 access points could not allow wireless nodes to "roam" between access points. More expensive 802.11 "bridges" offered that ability, but required each access point to be connected by Ethernet to each other and to the larger Internet. Later bridges such as the Cisco/Aironet 350 would allow access points to connect back to the Internet and other access points over the air -- what a concept! -- in a "Static WDS" configuration.
Different 802.11 Access Point (AP) vendors have manufactured equipment that uses WDS in different ways:
Static WDS
With this type of configuration, a number of WDS links (MAC addresses of other APs within range) are manually configured on each Access Point and recorded in an internal WDS link table. Client traffic that needs to relay through another access point or bridge is resent over the air toward its destination, using WDS frames.
Dynamic WDS (aka Lazy-WDS)
In this configuration an AP automatically learns about other WDS-capable APs. This is done by recording the addresses of all the sources of WDS traffic in the vicinity. We could not find documentation on whether only broadcast WDS traffic or just any WDS traffic will trigger an AP to add a record another AP as WDS-capable.
APs that do Lazy-WDS
- Linksys WRT54G, undocumented. Cannot be turned off.
- Buffalo WHR-HP-G54. Can be turned off.
- Apple Airport Express. Can be turned off. [default: off].
XO use of WDS frames
The Marvell wireless chip used in XO laptops is programmed with firmware that creates a wireless mesh automatically. This is similar to Lazy-WDS in intent (any node can talk to any other node, even if they're outside of direct radio range; the packets are relayed via intermediate nodes). The implementation tries to follow the draft 802.11s standard (which is unfortunately not available on the Internet due to IEEE standardization secrecy that protects their revenue stream). OLPC mesh frames use WDS frame format augmented with a new mesh specific header.
Interactions Between XO's and other WDS nodes
Lazy-WDS APs will interpret XO mesh traffic as WDS and create a new WDS link for each XO in the vicinity. This has created numerous problems:
WDS responses to infra frames
At least in one AP (Linksys WRT54G) the WDS link will override the association table, so, even if the xo is associated with the AP, all traffic from the AP to the xo will be sent in WDS format. The xo's can differentiate normal WDS frames (sent from the AP) from OLPC mesh traffic (from other xo's), so this does not cause any user observable problem (#901).
Spurious traffic
When authentication is enabled, a Lazy-WDS AP will try to authenticate with other WDS-peers. Because xo's are wrongfully recorded as WDS nodes, we've seen spurious authentication frames sent to them from the AP. That has the effect of waking up suspended xo's for no apparent reason (#3504).
In addition to the authentication frames, we have also observed the AP sending NULL data frames to the xo's:
No. Time Source Destination Protocol Info 3816 9.233094 Cisco-Li_b8:6d:d3 QuantaMi_05:26:1f IEEE 802.11 Null function (No data),SN=2735,FN=0 4050 9.807919 Cisco-Li_b8:6d:d3 QuantaMi_05:26:1f IEEE 802.11 Null function (No data),SN=2747,FN=0 4316 10.428346 Cisco-Li_b8:6d:d3 QuantaMi_05:26:1f IEEE 802.11 Null function (No data),SN=2763,FN=0 4708 11.369663 Cisco-Li_b8:6d:d3 QuantaMi_05:26:1f IEEE 802.11 Null function (No data),SN=2780,FN=0 5132 12.399024 Cisco-Li_b8:6d:d3 QuantaMi_05:26:1f IEEE 802.11 Null function (No data),SN=2795,FN=0
It's been hypothesized (Rajesh) that Lazy-WDS APs may use NULL data frames to detect if WDS peers are alive.
Denial of Service
OpenWRT is an open source version of the software that runs on the WRT54G. With that software, it is possible to turn off Lazy WDS. What is not possible, though, is to prevent the wireless firmware from internally tagging nodes in range as "WDS capable". Once a node is tagged as "WDS capable", the wireless module will drop any non-WDS traffic to that destination. So turning Lazy-WDS off will result in effectively cutting any communication with all the xo's in range, even if the xo is associated to the AP. Note that this has only been observed on an access point that was re-imaged to use the unsupported OpenWRT firmware.
WDS-link table overflow
The table of WDS-links must have a size limit. At OLPC headquarters, where there are over one hundred active xo's at any point in time, we could see APs with a large number of WDS links. At some point the AP would mistakenly send traffic destined for one xo to a different node. It is not clear yet why this happened (#4131).
Duplicate frames
Not sure why, but Lazy-WDS APs (at least the WRT54G) generate two WDS responses for each frame received from an associated station (#1863).
Cause other stations to lose association
Several people have reported this, but we don't have a traffic capture to confirm that this is related to Lazy-WDS.
Solutions
Ban Lazy-WDS APs across the land. If that is not possible by tomorrow morning, ask vendors to provide firmware upgrades that allow turning off WDS entirely.
